I'm curious to know if there are any significant threats presented by files which are uploaded and read but are never saved to disk? I've read countless articles about file uploads regarding storage and retrieval of the file itself but I haven't found any information on simply keeping the file in memory. My specific situation is as follows:
I have an HTTP endpoint which will accept CSV files from users. For a file to be accepted, it must be in a predetermined format and encoding. The file bytes will be read and converted to a CSV OOP model, which will then verify valid characters and persist the values (not the CSV file) to a database via parameterized queries (I realize that this is a form of persistence to disk but in this scenario, the data would be sanitized/verified by this point). Any invalid character (markup, code, invalid whitespace, etc) in the byte stream will cancel the entire process and return an error. Any invalid/unknown CSV field will cause the same cancellation/error.
It seems that most of the risks with file uploads are associated with the file's permissions on disk, surreptitious contents intended for execution, and the like. All of which involve the file being persisted as-is (or approximately so) and then handled by the OS/runtime in some exploitable way.
If a file is only read into memory from the network and then garbage collected, what vectors might an attacker exploit?
UPDATE 2109-03-07: This question states (erroneously on my part) that the parsing would occur before checking characters against whitelist. In the actual scenario, characters are checked before parsing. Leaving the original scenario as-is to maintain the context addressed by Euphrasius.